Filtered by vendor Redhat Subscriptions
Total 23252 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-46976 2 Linuxfoundation, Redhat 2 Backstage, Rhdh 2025-01-03 6.5 Medium
Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-49767 2 Palletsprojects, Redhat 3 Quart, Werkzeug, Openshift Ai 2025-01-03 7.5 High
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
CVE-2017-18017 9 Arista, Canonical, Debian and 6 more 33 Eos, Ubuntu Linux, Debian Linux and 30 more 2025-01-03 9.8 Critical
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
CVE-2022-38023 5 Fedoraproject, Microsoft, Netapp and 2 more 18 Fedora, Windows Server 2008, Windows Server 2008 R2 and 15 more 2025-01-03 8.1 High
Netlogon RPC Elevation of Privilege Vulnerability
CVE-2022-29145 3 Fedoraproject, Microsoft, Redhat 7 Fedora, .net, .net Core and 4 more 2025-01-02 7.5 High
.NET and Visual Studio Denial of Service Vulnerability
CVE-2022-29117 3 Fedoraproject, Microsoft, Redhat 7 Fedora, .net, .net Core and 4 more 2025-01-02 7.5 High
.NET and Visual Studio Denial of Service Vulnerability
CVE-2022-23267 3 Fedoraproject, Microsoft, Redhat 9 Fedora, .net, .net Core and 6 more 2025-01-02 7.5 High
.NET and Visual Studio Denial of Service Vulnerability
CVE-2022-21986 3 Fedoraproject, Microsoft, Redhat 6 Fedora, .net, Visual Studio 2019 and 3 more 2025-01-02 7.5 High
.NET Denial of Service Vulnerability
CVE-2023-35390 2 Microsoft, Redhat 6 .net, Visual Studio, Visual Studio 2022 and 3 more 2025-01-01 7.8 High
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2023-33170 3 Fedoraproject, Microsoft, Redhat 7 Fedora, .net, Visual Studio and 4 more 2025-01-01 8.1 High
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
CVE-2023-33128 2 Microsoft, Redhat 7 .net, Powershell, Visual Studio and 4 more 2025-01-01 7.3 High
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2023-32032 2 Microsoft, Redhat 5 .net, Powershell, Visual Studio and 2 more 2025-01-01 6.5 Medium
.NET and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-29337 2 Microsoft, Redhat 4 Nuget, Enterprise Linux, Rhel Dotnet and 1 more 2025-01-01 7.1 High
NuGet Client Remote Code Execution Vulnerability
CVE-2023-24936 2 Microsoft, Redhat 19 .net, .net Framework, Powershell and 16 more 2025-01-01 7.5 High
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-21538 3 Fedoraproject, Microsoft, Redhat 5 Fedora, .net, Powershell and 2 more 2025-01-01 7.5 High
.NET Denial of Service Vulnerability
CVE-2018-20060 3 Fedoraproject, Python, Redhat 4 Fedora, Urllib3, Ansible Tower and 1 more 2024-12-27 N/A
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
CVE-2018-12121 2 Nodejs, Redhat 9 Node.js, Enterprise Linux, Enterprise Linux Desktop and 6 more 2024-12-27 7.5 High
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
CVE-2023-45853 3 Redhat, Smihica, Zlib 3 Jboss Core Services, Pyminizip, Zlib 2024-12-20 9.8 Critical
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
CVE-2019-17546 3 Libtiff, Osgeo, Redhat 3 Libtiff, Gdal, Enterprise Linux 2024-12-20 8.8 High
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2024-36885 1 Redhat 1 Enterprise Linux 2024-12-19 4.4 Medium
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.